Post on 12-Jan-2016
description
What ciphers do Encryption ciphers
Provide confidentialityEve can’t see what Alice and Bob are sayingCan Eve do anything?
Alice Bob
Eve
?
C= Encrypt(M)
What ciphers don’t do Suppose Eve can get between Alice and Bob
What if Eve can manipulate the data?
Alice Bob
Eve
MM’
I’ll send Bob M
Alice sent me M’
Now for a few changes
Now for a few changes
Eve replaces M with M’
How can Bob tell if Alice’s message was
modified?
How can Bob tell if Alice’s message was
modified?
Hash functionsMap a variable length message to a fixed length
messagey = h(x)If h is a 64-bit hash function, then y always fits in 64
bits0 ≤ y < 264
Actual hash value may be represented with fewer bits, since 0, 1, etc. are in the output range
Should include leading zeros
Pigeonhole principleIf n+1 pigeons nest in n holes, at least one hole has more
than one pigeonMaybe each hole has one pigeon, except for one that has twoMaybe all the pigeons are in the same hole
Was the message modified?Alice sends Bob {C = Encrypt(M), h(M)}
When Bob gets {C, h(M)} , he checksM’=Decrypt(C)Bob computes h(M’)h(M) = h(M’)?
If Eve modifies the message, it probably won’t match
If it does match, assume that it is the message Alice sent
What could go wrong?Suppose h(x) maps to 1 or 0
with equal probability?Eve has a 50/50 chance of
fooling BobSuppose h(x) does not map
to the entire range with equal probability
Forget about the encryption for a moment
What could Eve do? Suppose:Eve can calculate f(h(M)) = MEve knows some M’, h(M’) =
h(M)Eve repeatedly just tries
random modifications
Nice try!Nice try!
We need some properties that
provide security!
Cryptographic hash functionsWhen security people talk about hash
functions, they mean cryptographic (or secure) hash functions
These should provideCollision resistance
Difficult to find any M, M’≠ M s.t. h(M) = h(M’)Preimage resistance
Given h(M), difficult to find M’ s.t. h(M’)=h(M)Second preimage resistance
Given M, difficult to find M’ s.t. h(M’)=h(M), M’≠M
If a hash function h does not meet these requirements… FAIL!
FAIL!
But what does it all mean?If h is secure
Easy to compute in one directionVery difficult to compute in the other
directionComputationally infeasiblei.e. your grandchildren’s grandchildren’s
grandchildren will be long gone before that computation finishes
Very difficult to find two messages that hash to the same value
Can anyone name any?
Secure Hash Algorithm (SHA)NIST standards
Mandatory in US GovernmentAdopted globally
SHA (SHA-0) is no good anymoreSHA-1 has attacks and is not recommendedSHA-2 looks good for now
What happens when there’s an attack?It takes years to create and analyze functions
SHA-3About halfway through the process of
choosing the next SHA family of hash functions
International competition64 submissionsRound 1: 54Round 2: 14Round 3: ~5And the winner is… ?
Winner gets massive bragging rightsA lot of new design techniquesA lot of new attack techniques
Who can compute a hash?A hash is a keyless algorithmAnyone can compute h(x) if they know xEve could replace M with M’ and h(M) with
h(M’)The hash matches what Bob computes, so he
assumes that Alice sent him M’
How could we stop Eve from doing this?
HMACHash-based Message Authentication CodeKeyed hash
y = HMAC(M, k)Provides some level of authentication
If only and Alice and Bob know the key and the HMAC is correct, it must have come from one of them
Can make an HMAC algorithm from an unkeyed hash algorithm
Why not just make a keyed hash algorithm?Import/export restrictionsKeyless algorithms are not restricted
How to key an unkeyed hashWe have hash function h, which processes
a message in b-byte blocksLet k be a key, |k| ≤ bPad k with zeros to form k’, |k’| = bLet ipad be 00110110, repeated b timesLet opad be 01011100, repeated b timesHMAC-h is formed by
HMAC-h(k,m) = h(k’ opad || h(k’ ipad || m))
Who sent it?For HMACs, the key is sharedFine for some applications
What if instead of knowing if someone who knows the key sent it, we want to know that Alice sent it?
Digital signaturesUse public key cryptography
Recall that only Alice knows Alice’s private keyAlice digitally signs her message, M
Alice computes h(M)Alice encrypts h(M) using her private key (signing)Alice sends Bob {M, Enc(h(M), Apriv)}
Bob verifies the message was sent by AliceComputes y’ = h(M)Decrypts Enc(h(M), Apriv) with Alice’s public key
y = Dec(Enc(h(M), Apriv), Apub)
Does y’ = y?If yes, Alice must have sent it
Digital SignaturesDigital signatures provide checks for
integrity and originBecause only Alice knows her private key,
it must have been her that sent itNon-repudiation
Suppose Alice wants to encrypt M so that Eve can’t see it Should she:Encrypt, then signSign, then encryptDoes it matter?Why?